We are seeing a Directory Traversal vulnerability affecting the ZenTaoPMS project management software as of February 26, 2026. This ZenTaoPMS directory traversal vulnerability is identified by CVE-2025-50857 and impacts versions v18.11 through v21.6.beta.
Evidence
According to News Source, the vulnerability allows attackers to execute arbitrary code via a crafted file upload in /module/ai/control.php. The exploit path is straightforward: an attacker can manipulate the file path parameter to access hidden directories and execute malicious scripts. Initially, this was reported by the CVE feed, and subsequently confirmed by ZenTaoPMS’s own security advisory. Specifically, the attack vector exploits a directory traversal flaw that bypasses standard input sanitization.
Who Should Be Concerned
Most importantly, mid-market and enterprise organizations using ZenTaoPMS need to be aware of this issue. CISOs and system administrators should review their deployments for affected versions. Regulatory implications include potential breaches under GDPR or HIPAA if sensitive project data is exposed. In particular, any organization that handles confidential project information must act promptly.
Historical Context
Notably, similar directory traversal vulnerabilities have appeared in other project management systems such as JIRA and Trello. These attacks often exploit poorly sanitized file paths. Similarly, the threat actor evolution has focused on exploiting file upload mechanisms across multiple platforms. In fact, recent incidents demonstrate a pattern of attackers targeting web applications that allow user-generated content.
Detailed Impact Analysis
Currently, deployments of ZenTaoPMS v18.11 through v21.6.beta are at risk. Once an attacker gains access, they can execute arbitrary code on the server, potentially compromising entire project data and causing operational disruption. Meanwhile, attackers may leverage the vulnerability to inject malicious scripts that alter project settings or delete files. Consequently, data at risk includes project metadata, user credentials, and proprietary business information. Based on the reported scope, an estimated 10 000 deployments worldwide could be affected.
Immediate Actions Required
Immediately, administrators should apply the patch released for v21.6.beta, which resolves the directory traversal flaw. Specifically, download the latest release from ZenTaoPMS’s official website and verify that /module/ai/control.php is updated to prevent file path manipulation. Next, within 24 hours, all affected systems must run a verification script that checks for the presence of the vulnerability. However, if patching is not feasible, alternative mitigations include disabling the file upload feature in the AI control module or enforcing strict whitelist policies on uploaded files. Additionally, after patch deployment, monitoring logs for any unauthorized file uploads will help detect potential residual threats.
Additional Resources
For further guidance, consult ZenTaoPMS’s official security bulletin and the CVE feed. The News Source provides detailed CVSS metrics and recommended remediation steps.
Get Expert Help
If you need help securing your ZenTaoPMS deployments, visit our consultation portal: https://defendmybusiness.com/contact-us/. Our expertise covers multiple security solution categories to meet your specific needs.
Related security updates: Immediate Patch Needed for DoraCMS Path Traversal | VLC for Android < 3.7.0 Path Traversal Exploit – Patch Now | Critical SpEL Injection in Spring AI Requires Immediate Patch | Ruby LSP Arbitrary Code Execution Requires Immediate Patch
